VoIP.info Guide

NAT for VoIP: signaling and media addresses

Map each translation boundary and compare advertised destinations with reachable addresses.

Reviewed 2026-10-28Foundational

Address translation affects multiple layers

NAT changes network addressing, while SIP and SDP can also carry addresses inside signaling. A translated packet source does not automatically correct every application-level address. This is why call setup can work while incoming delivery or audio fails.

Compare the advertised and actual media address
A phone or PBX at private address 10.0.0.10 sends through a NAT/firewall to a remote service. Return media also traverses that boundary and must reach the intended endpoint.

10.0.0.10 is an illustrative private address. Both directions traverse the NAT/firewall; signaling success does not validate SDP media reachability.

Draw both participants

Identify whether the PBX, phone or both are behind NAT. Record which side initiates communication and whether media is relayed. A solution for an office PBX behind a router may not suit a public VPS with remote phones.

Inspect the failed direction

For registration or incoming calls, review contact and response routing. For missing sound, inspect SDP and actual media destinations. Use the PBX's topology-specific settings and carrier guidance, then review the matching firewall policy.

Avoid universal fixes

Broad port forwarding, indiscriminate SIP ALG changes and copying every NAT option can introduce new problems. Make one evidence-supported change and re-test internal, outside and transferred calls. A VPN changes the reachable topology and should trigger a fresh review of earlier NAT workarounds.

Use Linphone NatPolicy without flattening traversal methods

Liblinphone exposes ICE, STUN, TURN and UPnP as distinct controls with different precedence and evidence. The Linphone traversal guide maps those controls to candidates and the selected path rather than presenting one universal NAT switch.

Trace Flowroute Direct Media through the public RTP range

The Flowroute diagnostic compares SDP, translation, negotiated ports and observed packet direction after signaling reaches the intended route.

Keep Jitsi Desktop registration and media traversal separate

The Jitsi Desktop diagnostic compares REGISTER Contact, INVITE signaling, SDP addresses and observed RTP independently.

Avoid stacking HT81x V2 routing without topology evidence

The HT812 V2 and HT814 V2 include configurable NET1/NET2 and NAT-router roles; record the chosen topology before diagnosing SIP or RTP.

Branch HT802 V2 and HT818 V2 topology correctly

The HT802 V2 has one 10/100 interface, while the HT818 V2 documents dual-Gigabit integrated routing.

Verify bridge or router mode on HT841 and HT881

The HT841/HT881 diagnostic records effective topology and preserves Grandstream’s conflicting Ethernet-speed publications.

Place HT813 WAN and LAN on the actual diagram

The HT813 diagnostic distinguishes upstream WAN reachability from devices behind its LAN router and DHCP boundary.

Identify the ordered Allstream NAT pattern first

The Allstream guide separates public no-NAT, NAT with ALG, NAT without ALG and private-VPN patterns and keeps the order’s public and private addresses authoritative.

Correlate Cloudli registration across the NAT boundary

The Cloudli diagnostic tracks consecutive local, translated and remote tuples instead of inferring stable registration from one response.

Treat Crazytel CGNAT settings as mitigations

The Crazytel SIP Trunking guide keeps NAT Helper, expiry, keepalive, public address and media reachability separate.

Separate MaxoTel SIP ALG and NAT evidence

The MaxoTel SIP trunk diagnostic tests signaling rewriting, source-port reuse and mapping lifetime independently.

Do not equate general CGNAT guidance with a trunk requirement

The Aussie Broadband SIP trunk diagnostic proves the ordered SIP handoff before opting out of CGNAT or adding forwarding.

Keep Wave RemoteConnect and direct public access distinct

The Grandstream Wave diagnostic preserves the configured service address, UCM association and observed media path rather than guessing NAT rules.

Keep IAX2 registration address and media observations distinct

The IAX2 AMI evidence guide does not convert a registry row into end-to-end reachability or audio proof.

Do not assume a Symbio access topology

The Symbio Enterprise SIP trunk diagnostic starts with the delivered Internet, private-interconnect, SBC or managed-edge boundary.

Do not copy Business SIP router rules into SIP Connect

The Telstra SIP Connect guide binds NAT and routing to the ordered access and confidential design.

Bind Optus NAT behavior to the delivered design

The Optus Evolve Voice guide leaves public addresses, translation and SIP ALG unassigned until the application and OM.37683 prove them.

Bind One NZ NAT behavior to the ordered design

The One NZ SIP guide leaves public addressing, translation and SIP ALG unassigned until the implementation evidence proves them.

Bind 2degrees NAT behavior to implementation evidence

The 2degrees SIP guide leaves addressing, source trust and translation unassigned until the current order proves them.

Bind Vocus translation to the ordered access

The Vocus SIP Voice guide separates UC Access from over-the-top internet delivery before assigning NAT behavior.

Bind Superloop NAT behavior to actual access

The Superloop SIP guide does not infer one translation model from a product diagram.

Keep Zoom client local and remote address evidence bounded

The Zoom Workplace diagnostic retains local and remote IP and port for the exact call without converting those statistics into a universal media policy.

Keep Enreach addressing product-specific

The Enreach SIP Trunks guide does not transfer service-provider platform or another-country addressing to one account.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.